[PATCH v1 0/3] kdumpctl: Add basic UKI support

[Philipp Rudo]

Hi everybody,

This short series adds basic support for UKIs as they are currently implemented
in RHEL. There's still the issue on Azure which causes the crash kernel to hang
when reading from /proc/vmcore. But I'm confident that it is not connected to
the implementation in kdumpctl. At least all test on my local VM without AMD
SEV-SNP work perfectly fine.

Furthermore, while the MR for the new naming convention for  kernel-ark to
rename the installed UKI has been merged the one for rhel9 is still open.
Nevertheless I've switched to the new naming convention in v1 now.

Thanks
Philipp

rfc -> v1:
* rebased to latest rawhide
* use new naming convention suggested by BLS
* fix quoting issues found by shellcheck
* change is_uki to look at the file content rather than relying on the naming
  convention. This is mostly done to allow developers to use their own UKI that
  does not comply with the naming convention. This change also required small
  changes to prepare_kdump_kernel. (Thanks to Pingfan)

Philipp Rudo (3):
  kdumpctl: Move get_kernel_size to kdumpctl
  kdumpctl: Move temp file in get_kernel_size to global temp dir
  kdumpctl: Add basic UKI support

 kdump-lib.sh     | 98 ++++++++++++------------------------------------
 kdump.service    |  1 +
 kdumpctl         | 90 +++++++++++++++++++++++++++++++++++++++++++-
 kexec-tools.spec |  1 +
 4 files changed, 115 insertions(+), 75 deletions(-)

-- 
2.40.1

[PATCH v1 1/3] kdumpctl: Move get_kernel_size to kdumpctl

[Philipp Rudo]

The function is only used in do_estimate. Move it to kdumpctl to
prevent confusion.

Signed-off-by: Philipp Rudo <prudo(a)redhat.com&gt;
---
 kdump-lib.sh | 72 ----------------------------------------------------
 kdumpctl     | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 72 deletions(-)

diff --git a/kdump-lib.sh b/kdump-lib.sh
index 75b31b2..3f9b494 100755
--- a/kdump-lib.sh
+++ b/kdump-lib.sh
@@ -853,75 +853,3 @@ get_all_kdump_crypt_dev()
 		get_luks_crypt_dev "$(kdump_get_maj_min "$_dev")"
 	done
 }
-
-check_vmlinux()
-{
-	# Use readelf to check if it's a valid ELF
-	readelf -h "$1" &> /dev/null || return 1
-}
-
-get_vmlinux_size()
-{
-	local size=0 _msize
-
-	while read -r _msize; do
-		size=$((size + _msize))
-	done <<< "$(readelf -l -W "$1" | awk '/^  LOAD/{print
$6}' 2> /dev/stderr)"
-
-	echo $size
-}
-
-try_decompress()
-{
-	# The obscure use of the "tr" filter is to work around older versions of
-	# "grep" that report the byte offset of the line instead of the pattern.
-
-	# Try to find the header ($1) and decompress from here
-	for pos in $(tr "$1\n$2" "\n$2=" < "$4" | grep -abo
"^$2"); do
-		if ! type -P "$3" > /dev/null; then
-			ddebug "Signiature detected but '$3' is missing, skip this
decompressor"
-			break
-		fi
-
-		pos=${pos%%:*}
-		tail "-c+$pos" "$img" | $3 > "$5" 2> /dev/null
-		if check_vmlinux "$5"; then
-			ddebug "Kernel is extracted with '$3'"
-			return 0
-		fi
-	done
-
-	return 1
-}
-
-# Borrowed from linux/scripts/extract-vmlinux
-get_kernel_size()
-{
-	# Prepare temp files:
-	local tmp img=$1
-
-	tmp=$(mktemp /tmp/vmlinux-XXX)
-	trap 'rm -f "$tmp"' 0
-
-	# Try to check if it's a vmlinux already
-	check_vmlinux "$img" && get_vmlinux_size "$img" &&
return 0
-
-	# That didn't work, so retry after decompression.
-	try_decompress '\037\213\010' xy gunzip "$img" "$tmp" ||
-		try_decompress '\3757zXZ\000' abcde unxz "$img" "$tmp" ||
-		try_decompress 'BZh' xy bunzip2 "$img" "$tmp" ||
-		try_decompress '\135\0\0\0' xxx unlzma "$img" "$tmp" ||
-		try_decompress '\211\114\132' xy 'lzop -d' "$img"
"$tmp" ||
-		try_decompress '\002!L\030' xxx 'lz4 -d' "$img"
"$tmp" ||
-		try_decompress '(\265/\375' xxx unzstd "$img" "$tmp"
-
-	# Finally check for uncompressed images or objects:
-	[[ $? -eq 0 ]] && get_vmlinux_size "$tmp" && return 0
-
-	# Fallback to use iomem
-	local _size=0 _seg
-	while read -r _seg; do
-		_size=$((_size + 0x${_seg#*-} - 0x${_seg%-*}))
-	done <<< "$(grep -E "Kernel (code|rodata|data|bss)" /proc/iomem
| cut -d ":" -f 1)"
-	echo $_size
-}
diff --git a/kdumpctl b/kdumpctl
index 2c647d6..6341709 100755
--- a/kdumpctl
+++ b/kdumpctl
@@ -1147,6 +1147,78 @@ rebuild()
 	rebuild_initrd
 }
 
+check_vmlinux()
+{
+	# Use readelf to check if it's a valid ELF
+	readelf -h "$1" &> /dev/null || return 1
+}
+
+get_vmlinux_size()
+{
+	local size=0 _msize
+
+	while read -r _msize; do
+		size=$((size + _msize))
+	done <<< "$(readelf -l -W "$1" | awk '/^  LOAD/{print
$6}' 2> /dev/stderr)"
+
+	echo $size
+}
+
+try_decompress()
+{
+	# The obscure use of the "tr" filter is to work around older versions of
+	# "grep" that report the byte offset of the line instead of the pattern.
+
+	# Try to find the header ($1) and decompress from here
+	for pos in $(tr "$1\n$2" "\n$2=" < "$4" | grep -abo
"^$2"); do
+		if ! type -P "$3" > /dev/null; then
+			ddebug "Signiature detected but '$3' is missing, skip this
decompressor"
+			break
+		fi
+
+		pos=${pos%%:*}
+		tail "-c+$pos" "$img" | $3 > "$5" 2> /dev/null
+		if check_vmlinux "$5"; then
+			ddebug "Kernel is extracted with '$3'"
+			return 0
+		fi
+	done
+
+	return 1
+}
+
+# Borrowed from linux/scripts/extract-vmlinux
+get_kernel_size()
+{
+	# Prepare temp files:
+	local tmp img=$1
+
+	tmp=$(mktemp /tmp/vmlinux-XXX)
+	trap 'rm -f "$tmp"' 0
+
+	# Try to check if it's a vmlinux already
+	check_vmlinux "$img" && get_vmlinux_size "$img" &&
return 0
+
+	# That didn't work, so retry after decompression.
+	try_decompress '\037\213\010' xy gunzip "$img" "$tmp" ||
+		try_decompress '\3757zXZ\000' abcde unxz "$img" "$tmp" ||
+		try_decompress 'BZh' xy bunzip2 "$img" "$tmp" ||
+		try_decompress '\135\0\0\0' xxx unlzma "$img" "$tmp" ||
+		try_decompress '\211\114\132' xy 'lzop -d' "$img"
"$tmp" ||
+		try_decompress '\002!L\030' xxx 'lz4 -d' "$img"
"$tmp" ||
+		try_decompress '(\265/\375' xxx unzstd "$img" "$tmp"
+
+	# Finally check for uncompressed images or objects:
+	[[ $? -eq 0 ]] && get_vmlinux_size "$tmp" && return 0
+
+	# Fallback to use iomem
+	local _size=0 _seg
+	while read -r _seg; do
+		_size=$((_size + 0x${_seg#*-} - 0x${_seg%-*}))
+	done <<< "$(grep -E "Kernel (code|rodata|data|bss)" /proc/iomem
| cut -d ":" -f 1)"
+	echo $_size
+}
+
 do_estimate()
 {
 	local kdump_mods
-- 
2.40.1

[PATCH v1 1/3] kdumpctl: Move get_kernel_size to kdumpctl

[Pingfan Liu]

On Fri, May 5, 2023 at 11:14 PM Philipp Rudo <prudo(a)redhat.com&gt; wrote:
>  The function is only used in do_estimate. Move it to kdumpctl to
>  prevent confusion.
>
>  Signed-off-by: Philipp Rudo <prudo(a)redhat.com&gt;
>  ---
>   kdump-lib.sh | 72 ----------------------------------------------------
>   kdumpctl     | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++
>   2 files changed, 72 insertions(+), 72 deletions(-)
>
>  diff --git a/kdump-lib.sh b/kdump-lib.sh
>  index 75b31b2..3f9b494 100755
>  --- a/kdump-lib.sh
>  +++ b/kdump-lib.sh
>  @@ -853,75 +853,3 @@ get_all_kdump_crypt_dev()
>                  get_luks_crypt_dev "$(kdump_get_maj_min "$_dev")"
>          done
>   }
>  -
>  -check_vmlinux()
>  -{
>  -       # Use readelf to check if it's a valid ELF
>  -       readelf -h "$1" &> /dev/null || return 1
>  -}
>  -
>  -get_vmlinux_size()
>  -{
>  -       local size=0 _msize
>  -
>  -       while read -r _msize; do
>  -               size=$((size + _msize))
>  -       done <<< "$(readelf -l -W "$1" | awk '/^  LOAD/{print
> $6}' 2> /dev/stderr)"
>  -
>  -       echo $size
>  -}
>  -
>  -try_decompress()
>  -{
>  -       # The obscure use of the "tr" filter is to work around older versions
> of
>  -       # "grep" that report the byte offset of the line instead of the
> pattern.
>  -
>  -       # Try to find the header ($1) and decompress from here
>  -       for pos in $(tr "$1\n$2" "\n$2=" < "$4" | grep
> -abo "^$2"); do
>  -               if ! type -P "$3" > /dev/null; then
>  -                       ddebug "Signiature detected but '$3' is missing,
> skip this decompressor"
>  -                       break
>  -               fi
>  -
>  -               pos=${pos%%:*}
>  -               tail "-c+$pos" "$img" | $3 > "$5" 2>
> /dev/null
>  -               if check_vmlinux "$5"; then
>  -                       ddebug "Kernel is extracted with '$3'"
>  -                       return 0
>  -               fi
>  -       done
>  -
>  -       return 1
>  -}
>  -
>  -# Borrowed from linux/scripts/extract-vmlinux
>  -get_kernel_size()
>  -{
>  -       # Prepare temp files:
>  -       local tmp img=$1
>  -
>  -       tmp=$(mktemp /tmp/vmlinux-XXX)
>  -       trap 'rm -f "$tmp"' 0
>  -
>  -       # Try to check if it's a vmlinux already
>  -       check_vmlinux "$img" && get_vmlinux_size "$img"
> && return 0
>  -
>  -       # That didn't work, so retry after decompression.
>  -       try_decompress '\037\213\010' xy gunzip "$img" "$tmp"
> ||
>  -               try_decompress '\3757zXZ\000' abcde unxz "$img"
> "$tmp" ||
>  -               try_decompress 'BZh' xy bunzip2 "$img" "$tmp"
> ||
>  -               try_decompress '\135\0\0\0' xxx unlzma "$img"
> "$tmp" ||
>  -               try_decompress '\211\114\132' xy 'lzop -d'
> "$img" "$tmp" ||
>  -               try_decompress '\002!L\030' xxx 'lz4 -d' "$img"
> "$tmp" ||
>  -               try_decompress '(\265/\375' xxx unzstd "$img"
> "$tmp"
>  -
>  -       # Finally check for uncompressed images or objects:
>  -       [[ $? -eq 0 ]] && get_vmlinux_size "$tmp" && return 0
>  -
>  -       # Fallback to use iomem
>  -       local _size=0 _seg
>  -       while read -r _seg; do
>  -               _size=$((_size + 0x${_seg#*-} - 0x${_seg%-*}))
>  -       done <<< "$(grep -E "Kernel (code|rodata|data|bss)"
> /proc/iomem | cut -d ":" -f 1)"
>  -       echo $_size
>  -}
>  diff --git a/kdumpctl b/kdumpctl
>  index 2c647d6..6341709 100755
>  --- a/kdumpctl
>  +++ b/kdumpctl
>  @@ -1147,6 +1147,78 @@ rebuild()
>          rebuild_initrd
>   }
>
>  +check_vmlinux()
>  +{
>  +       # Use readelf to check if it's a valid ELF
>  +       readelf -h "$1" &> /dev/null || return 1
>  +}
>  +
>  +get_vmlinux_size()
>  +{
>  +       local size=0 _msize
>  +
>  +       while read -r _msize; do
>  +               size=$((size + _msize))
>  +       done <<< "$(readelf -l -W "$1" | awk '/^  LOAD/{print
> $6}' 2> /dev/stderr)"
>  +
>  +       echo $size
>  +}
>  +
>  +try_decompress()
>  +{
>  +       # The obscure use of the "tr" filter is to work around older versions
> of
>  +       # "grep" that report the byte offset of the line instead of the
> pattern.
>  +
>  +       # Try to find the header ($1) and decompress from here
>  +       for pos in $(tr "$1\n$2" "\n$2=" < "$4" | grep
> -abo "^$2"); do
>  +               if ! type -P "$3" > /dev/null; then
>  +                       ddebug "Signiature detected but '$3' is missing,
> skip this decompressor"
>  +                       break
>  +               fi
>  +
>  +               pos=${pos%%:*}
>  +               tail "-c+$pos" "$img" | $3 > "$5" 2>
> /dev/null
>  +               if check_vmlinux "$5"; then
>  +                       ddebug "Kernel is extracted with '$3'"
>  +                       return 0
>  +               fi
>  +       done
>  +
>  +       return 1
>  +}
>  +
>  +# Borrowed from linux/scripts/extract-vmlinux
>  +get_kernel_size()
>  +{
>  +       # Prepare temp files:
>  +       local tmp img=$1
>  +
>  +       tmp=$(mktemp /tmp/vmlinux-XXX)
>  +       trap 'rm -f "$tmp"' 0
>  +
>  +       # Try to check if it's a vmlinux already
>  +       check_vmlinux "$img" && get_vmlinux_size "$img"
> && return 0
>  +
>  +       # That didn't work, so retry after decompression.
>  +       try_decompress '\037\213\010' xy gunzip "$img" "$tmp"
> ||
>  +               try_decompress '\3757zXZ\000' abcde unxz "$img"
> "$tmp" ||
>  +               try_decompress 'BZh' xy bunzip2 "$img" "$tmp"
> ||
>  +               try_decompress '\135\0\0\0' xxx unlzma "$img"
> "$tmp" ||
>  +               try_decompress '\211\114\132' xy 'lzop -d'
> "$img" "$tmp" ||
>  +               try_decompress '\002!L\030' xxx 'lz4 -d' "$img"
> "$tmp" ||
>  +               try_decompress '(\265/\375' xxx unzstd "$img"
> "$tmp"
>  +
>  +       # Finally check for uncompressed images or objects:
>  +       [[ $? -eq 0 ]] && get_vmlinux_size "$tmp" && return 0
>  +
>  +       # Fallback to use iomem
>  +       local _size=0 _seg
>  +       while read -r _seg; do
>  +               _size=$((_size + 0x${_seg#*-} - 0x${_seg%-*}))
>  +       done <<< "$(grep -E "Kernel (code|rodata|data|bss)"
> /proc/iomem | cut -d ":" -f 1)"
>  +       echo $_size
>  +}
>  +
>   do_estimate()
>   {
>          local kdump_mods
>  --
>  2.40.1
>  
Reviewed-by: Pingfan Liu <piliu(a)redhat.com&gt;

[PATCH v1 2/3] kdumpctl: Move temp file in get_kernel_size to global temp dir

[Philipp Rudo]

Others will need to use a temporary files, too. In order to avoid
potential clashes of multiple trap handlers move the local temp file
into a global temp dir.

While at it make sure that the trap handler returns the correct exit
code.

Signed-off-by: Philipp Rudo <prudo(a)redhat.com&gt;
---
 kdump.service |  1 +
 kdumpctl      | 10 ++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/kdump.service b/kdump.service
index 99feed8..15405dc 100644
--- a/kdump.service
+++ b/kdump.service
@@ -11,6 +11,7 @@ ExecStop=/usr/bin/kdumpctl stop
 ExecReload=/usr/bin/kdumpctl reload
 RemainAfterExit=yes
 StartLimitInterval=0
+PrivateTmp=yes
 
 [Install]
 WantedBy=multi-user.target
diff --git a/kdumpctl b/kdumpctl
index 6341709..ecbe0d4 100755
--- a/kdumpctl
+++ b/kdumpctl
@@ -45,6 +45,13 @@ if ! dlog_init; then
 	exit 1
 fi
 
+KDUMP_TMPDIR=$(mktemp -d kdump.XXXX)
+trap '
+    ret=$?;
+    rm -rf "$KDUMP_TMPDIR"
+    exit $ret;
+    ' EXIT
+
 _get_dracut_arg()
 {
 	local shortopt longopt n tmp
@@ -1193,8 +1200,7 @@ get_kernel_size()
 	# Prepare temp files:
 	local tmp img=$1
 
-	tmp=$(mktemp /tmp/vmlinux-XXX)
-	trap 'rm -f "$tmp"' 0
+	tmp="$KDUMP_TMPDIR/vmlinux"
 
 	# Try to check if it's a vmlinux already
 	check_vmlinux "$img" && get_vmlinux_size "$img" &&
return 0
-- 
2.40.1

[PATCH v1 2/3] kdumpctl: Move temp file in get_kernel_size to global temp dir

[Pingfan Liu]

On Fri, May 5, 2023 at 11:14 PM Philipp Rudo <prudo(a)redhat.com&gt; wrote:
>  Others will need to use a temporary files, too. In order to avoid
>  potential clashes of multiple trap handlers move the local temp file
>  into a global temp dir.
>
>  While at it make sure that the trap handler returns the correct exit
>  code.
>
>  Signed-off-by: Philipp Rudo <prudo(a)redhat.com&gt;
>  ---
>   kdump.service |  1 +
>   kdumpctl      | 10 ++++++++--
>   2 files changed, 9 insertions(+), 2 deletions(-)
>
>  diff --git a/kdump.service b/kdump.service
>  index 99feed8..15405dc 100644
>  --- a/kdump.service
>  +++ b/kdump.service
>  @@ -11,6 +11,7 @@ ExecStop=/usr/bin/kdumpctl stop
>   ExecReload=/usr/bin/kdumpctl reload
>   RemainAfterExit=yes
>   StartLimitInterval=0
>  +PrivateTmp=yes
>
>   [Install]
>   WantedBy=multi-user.target
>  diff --git a/kdumpctl b/kdumpctl
>  index 6341709..ecbe0d4 100755
>  --- a/kdumpctl
>  +++ b/kdumpctl
>  @@ -45,6 +45,13 @@ if ! dlog_init; then
>          exit 1
>   fi
>
>  +KDUMP_TMPDIR=$(mktemp -d kdump.XXXX)
>  +trap '
>  +    ret=$?;
>  +    rm -rf "$KDUMP_TMPDIR"
>  +    exit $ret;
>  +    ' EXIT
>  +
>   _get_dracut_arg()
>   {
>          local shortopt longopt n tmp
>  @@ -1193,8 +1200,7 @@ get_kernel_size()
>          # Prepare temp files:
>          local tmp img=$1
>
>  -       tmp=$(mktemp /tmp/vmlinux-XXX)
>  -       trap 'rm -f "$tmp"' 0
>  +       tmp="$KDUMP_TMPDIR/vmlinux"
>
>          # Try to check if it's a vmlinux already
>          check_vmlinux "$img" && get_vmlinux_size "$img"
> && return 0
>  --
>  2.40.1
>  
Reviewed-by: Pingfan Liu <piliu(a)redhat.com&gt;

[PATCH v1 3/3] kdumpctl: Add basic UKI support

[Philipp Rudo]

A Unified Kernel Image (UKI) is a single EFI PE executable combining an
EFI stub, a kernel image, an initrd image, and the kernel command line.
They are defined in the Boot Loader Specification [1] as type #2
entries. UKIs have the advantage that all code as well as meta data that
is required to boot the system, not only the kernel image, is combined
in a single PE file and can be signed for EFI SecureBoot. This extends
the coverage of SecureBoot extensively.

For RHEL support for UKI were included into kernel-ark with 16c7e3ee836e
("redhat: Add sub-RPM with a EFI unified kernel image for virtual
machines").

There are two problems with UKIs from the kdump point of view at the
moment. First, they cannot be directly loaded via kexec_file_load and
second, the initrd included isn't suitable for kdump. In order to enable
kdump on systems with UKIs build the kdump initrd as usual and extract
the kernel image before loading the crash kernel.

[1] https://uapi-group.org/specifications/specs/boot_loader_specification/

Signed-off-by: Philipp Rudo <prudo(a)redhat.com&gt;
---
 kdump-lib.sh     | 26 ++++++++++++++++++++++++--
 kdumpctl         | 12 +++++++++++-
 kexec-tools.spec |  1 +
 3 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/kdump-lib.sh b/kdump-lib.sh
index 3f9b494..4223508 100755
--- a/kdump-lib.sh
+++ b/kdump-lib.sh
@@ -11,6 +11,17 @@ fi
 FADUMP_ENABLED_SYS_NODE="/sys/kernel/fadump_enabled"
 FADUMP_REGISTER_SYS_NODE="/sys/kernel/fadump_registered"
 
+is_uki()
+{
+	local img
+
+	img="$1"
+
+	[[ -f "$img" ]] || return
+	[[ "$(file -b --mime-type "$img")" == application/x-dosexec ]] ||
return
+	objdump -h -j .linux "$img" &> /dev/null
+}
+
 is_fadump_capable()
 {
 	# Check if firmware-assisted dump is enabled
@@ -489,7 +500,9 @@ prepare_kdump_kernel()
 	read -r machine_id < /etc/machine-id
 
 	boot_dirlist=${KDUMP_BOOTDIR:-"/boot /boot/efi /efi /"}
-	boot_imglist="$KDUMP_IMG-$kdump_kernelver$KDUMP_IMG_EXT
$machine_id/$kdump_kernelver/$KDUMP_IMG"
+	boot_imglist="$KDUMP_IMG-$kdump_kernelver$KDUMP_IMG_EXT \
+		$machine_id/$kdump_kernelver/$KDUMP_IMG \
+		EFI/Linux/$machine_id-$kdump_kernelver.efi"
 
 	# The kernel of OSTree based systems is not in the standard locations.
 	if is_ostree; then
@@ -562,7 +575,11 @@ prepare_kdump_bootinfo()
 	fi
 
 	# Set KDUMP_BOOTDIR to where kernel image is stored
-	KDUMP_BOOTDIR=$(dirname "$KDUMP_KERNEL")
+	if is_uki "$KDUMP_KERNEL"; then
+		KDUMP_BOOTDIR=/boot
+	else
+		KDUMP_BOOTDIR=$(dirname "$KDUMP_KERNEL")
+	fi
 
 	# Default initrd should just stay aside of kernel image, try to find it in
KDUMP_BOOTDIR
 	boot_initrdlist="initramfs-$KDUMP_KERNELVER.img initrd"
@@ -715,6 +732,11 @@ prepare_cmdline()
 	# may cause the hot-remove of some pci hotplug device.
 	is_aws_aarch64 && out=$(echo "$out" | sed -e
"/\<irqpoll\>//")
 
+	# Always disable gpt-auto-generator as it hangs during boot of the
+	# crash kernel. Furthermore we know which disk will be used for dumping
+	# (if at all) and add it explicitly.
+	is_uki "$KDUMP_KERNEL" && out+="rd.systemd.gpt_auto=no "
+
 	# Trim unnecessary whitespaces
 	echo "$out" | sed -e "s/^ *//g" -e "s/ *$//g" -e "s/
\+/ /g"
 }
diff --git a/kdumpctl b/kdumpctl
index ecbe0d4..37f3eb9 100755
--- a/kdumpctl
+++ b/kdumpctl
@@ -694,7 +694,7 @@ function remove_kdump_kernel_key()
 # as the currently running kernel.
 load_kdump()
 {
-	local ret
+	local ret uki
 
 	KEXEC_ARGS=$(prepare_kexec_args "${KEXEC_ARGS}")
 	KDUMP_COMMANDLINE=$(prepare_cmdline "${KDUMP_COMMANDLINE}"
"${KDUMP_COMMANDLINE_REMOVE}" "${KDUMP_COMMANDLINE_APPEND}")
@@ -707,6 +707,16 @@ load_kdump()
 		load_kdump_kernel_key
 	fi
 
+	if is_uki "$KDUMP_KERNEL"; then
+		uki=$KDUMP_KERNEL
+		KDUMP_KERNEL=$KDUMP_TMPDIR/vmlinuz
+		objcopy -O binary --only-section .linux "$uki" "$KDUMP_KERNEL"
+		sync -f "$KDUMP_KERNEL"
+		# Make sure the temp file has the correct SELinux label.
+		# Otherwise starting the kdump.service will fail.
+		chcon -t boot_t "$KDUMP_KERNEL"
+	fi
+
 	ddebug "$KEXEC $KEXEC_ARGS $standard_kexec_args --command-line=$KDUMP_COMMANDLINE
--initrd=$TARGET_INITRD $KDUMP_KERNEL"
 
 	# The '12' represents an intermediate temporary file descriptor
diff --git a/kexec-tools.spec b/kexec-tools.spec
index d2a8aca..f1f0423 100644
--- a/kexec-tools.spec
+++ b/kexec-tools.spec
@@ -66,6 +66,7 @@ Requires: dracut-network >= 050
 Requires: dracut-squash >= 050
 Requires: ethtool
 Requires: util-linux
+Requires: binutils
 Recommends: grubby
 Recommends: hostname
 BuildRequires: make
-- 
2.40.1

[PATCH v1 3/3] kdumpctl: Add basic UKI support

[Pingfan Liu]

On Fri, May 5, 2023 at 11:14 PM Philipp Rudo <prudo(a)redhat.com&gt; wrote:
>  A Unified Kernel Image (UKI) is a single EFI PE executable combining an
>  EFI stub, a kernel image, an initrd image, and the kernel command line.
>  They are defined in the Boot Loader Specification [1] as type #2
>  entries. UKIs have the advantage that all code as well as meta data that
>  is required to boot the system, not only the kernel image, is combined
>  in a single PE file and can be signed for EFI SecureBoot. This extends
>  the coverage of SecureBoot extensively.
>
>  For RHEL support for UKI were included into kernel-ark with 16c7e3ee836e
>  ("redhat: Add sub-RPM with a EFI unified kernel image for virtual
>  machines").
>
>  There are two problems with UKIs from the kdump point of view at the
>  moment. First, they cannot be directly loaded via kexec_file_load and
>  second, the initrd included isn't suitable for kdump. In order to enable
>  kdump on systems with UKIs build the kdump initrd as usual and extract
>  the kernel image before loading the crash kernel.
>
>  [1] https://uapi-group.org/specifications/specs/boot_loader_specification/
>
>  Signed-off-by: Philipp Rudo <prudo(a)redhat.com&gt;
>  ---
>   kdump-lib.sh     | 26 ++++++++++++++++++++++++--
>   kdumpctl         | 12 +++++++++++-
>   kexec-tools.spec |  1 +
>   3 files changed, 36 insertions(+), 3 deletions(-)
>
>  diff --git a/kdump-lib.sh b/kdump-lib.sh
>  index 3f9b494..4223508 100755
>  --- a/kdump-lib.sh
>  +++ b/kdump-lib.sh
>  @@ -11,6 +11,17 @@ fi
>   FADUMP_ENABLED_SYS_NODE="/sys/kernel/fadump_enabled"
>   FADUMP_REGISTER_SYS_NODE="/sys/kernel/fadump_registered"
>
>  +is_uki()
>  +{
>  +       local img
>  +
>  +       img="$1"
>  +
>  +       [[ -f "$img" ]] || return
>  +       [[ "$(file -b --mime-type "$img")" == application/x-dosexec
> ]] || return
>  +       objdump -h -j .linux "$img" &> /dev/null
>  +}
>  +
>   is_fadump_capable()
>   {
>          # Check if firmware-assisted dump is enabled
>  @@ -489,7 +500,9 @@ prepare_kdump_kernel()
>          read -r machine_id < /etc/machine-id
>
>          boot_dirlist=${KDUMP_BOOTDIR:-"/boot /boot/efi /efi /"}
>  -       boot_imglist="$KDUMP_IMG-$kdump_kernelver$KDUMP_IMG_EXT
> $machine_id/$kdump_kernelver/$KDUMP_IMG"
>  +       boot_imglist="$KDUMP_IMG-$kdump_kernelver$KDUMP_IMG_EXT \
>  +               $machine_id/$kdump_kernelver/$KDUMP_IMG \
>  +               EFI/Linux/$machine_id-$kdump_kernelver.efi"
>
>          # The kernel of OSTree based systems is not in the standard locations.
>          if is_ostree; then
>  @@ -562,7 +575,11 @@ prepare_kdump_bootinfo()
>          fi
>
>          # Set KDUMP_BOOTDIR to where kernel image is stored
>  -       KDUMP_BOOTDIR=$(dirname "$KDUMP_KERNEL")
>  +       if is_uki "$KDUMP_KERNEL"; then
>  +               KDUMP_BOOTDIR=/boot
>  +       else
>  +               KDUMP_BOOTDIR=$(dirname "$KDUMP_KERNEL")
>  +       fi
>
>          # Default initrd should just stay aside of kernel image, try to find it in
> KDUMP_BOOTDIR
>          boot_initrdlist="initramfs-$KDUMP_KERNELVER.img initrd"
>  @@ -715,6 +732,11 @@ prepare_cmdline()
>          # may cause the hot-remove of some pci hotplug device.
>          is_aws_aarch64 && out=$(echo "$out" | sed -e
> "/\<irqpoll\>//")
>
>  +       # Always disable gpt-auto-generator as it hangs during boot of the
>  +       # crash kernel. Furthermore we know which disk will be used for dumping
>  +       # (if at all) and add it explicitly.
>  +       is_uki "$KDUMP_KERNEL" && out+="rd.systemd.gpt_auto=no
> "
>  +
>          # Trim unnecessary whitespaces
>          echo "$out" | sed -e "s/^ *//g" -e "s/ *$//g" -e
> "s/ \+/ /g"
>   }
>  diff --git a/kdumpctl b/kdumpctl
>  index ecbe0d4..37f3eb9 100755
>  --- a/kdumpctl
>  +++ b/kdumpctl
>  @@ -694,7 +694,7 @@ function remove_kdump_kernel_key()
>   # as the currently running kernel.
>   load_kdump()
>   {
>  -       local ret
>  +       local ret uki
>
>          KEXEC_ARGS=$(prepare_kexec_args "${KEXEC_ARGS}")
>          KDUMP_COMMANDLINE=$(prepare_cmdline "${KDUMP_COMMANDLINE}"
> "${KDUMP_COMMANDLINE_REMOVE}" "${KDUMP_COMMANDLINE_APPEND}")
>  @@ -707,6 +707,16 @@ load_kdump()
>                  load_kdump_kernel_key
>          fi
>
>  +       if is_uki "$KDUMP_KERNEL"; then
>  +               uki=$KDUMP_KERNEL
>  +               KDUMP_KERNEL=$KDUMP_TMPDIR/vmlinuz
>  +               objcopy -O binary --only-section .linux "$uki"
> "$KDUMP_KERNEL"
>  +               sync -f "$KDUMP_KERNEL"
>  +               # Make sure the temp file has the correct SELinux label.
>  +               # Otherwise starting the kdump.service will fail.
>  +               chcon -t boot_t "$KDUMP_KERNEL"
>  +       fi
>  +
>          ddebug "$KEXEC $KEXEC_ARGS $standard_kexec_args
> --command-line=$KDUMP_COMMANDLINE --initrd=$TARGET_INITRD $KDUMP_KERNEL"
>
>          # The '12' represents an intermediate temporary file descriptor
>  diff --git a/kexec-tools.spec b/kexec-tools.spec
>  index d2a8aca..f1f0423 100644
>  --- a/kexec-tools.spec
>  +++ b/kexec-tools.spec
>  @@ -66,6 +66,7 @@ Requires: dracut-network >= 050
>   Requires: dracut-squash >= 050
>   Requires: ethtool
>   Requires: util-linux
>  +Requires: binutils
>   Recommends: grubby
>   Recommends: hostname
>   BuildRequires: make
>  --
>  2.40.1
>  
Off topic, I propose a dedicated patch to make a signature on vmlinux
in kernel spec.

Reviewed-by: Pingfan Liu <piliu(a)redhat.com&gt;

[Coiby Xu]

This patch set has been merged, thanks to Philipp and Pingfan!

On Fri, May 05, 2023 at 05:14:39PM +0200, Philipp Rudo wrote:
> Hi everybody,
>
> This short series adds basic support for UKIs as they are currently implemented
> in RHEL. There's still the issue on Azure which causes the crash kernel to hang
> when reading from /proc/vmcore. But I'm confident that it is not connected to
> the implementation in kdumpctl. At least all test on my local VM without AMD
> SEV-SNP work perfectly fine.
>
> Furthermore, while the MR for the new naming convention for  kernel-ark to
> rename the installed UKI has been merged the one for rhel9 is still open.
> Nevertheless I've switched to the new naming convention in v1 now.
>
> Thanks
> Philipp
>
> rfc -> v1:
> * rebased to latest rawhide
> * use new naming convention suggested by BLS
> * fix quoting issues found by shellcheck
> * change is_uki to look at the file content rather than relying on the naming
>   convention. This is mostly done to allow developers to use their own UKI that
>   does not comply with the naming convention. This change also required small
>   changes to prepare_kdump_kernel. (Thanks to Pingfan)
>
> Philipp Rudo (3):
>   kdumpctl: Move get_kernel_size to kdumpctl
>   kdumpctl: Move temp file in get_kernel_size to global temp dir
>   kdumpctl: Add basic UKI support
>
>  kdump-lib.sh     | 98 ++++++++++++------------------------------------
>  kdump.service    |  1 +
>  kdumpctl         | 90 +++++++++++++++++++++++++++++++++++++++++++-
>  kexec-tools.spec |  1 +
>  4 files changed, 115 insertions(+), 75 deletions(-)
>
> -- 
> 2.40.1
> _______________________________________________
> kexec mailing list -- kexec(a)lists.fedoraproject.org
> To unsubscribe send an email to kexec-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue 
-- 
Best regards,
Coiby